f004c217525cbf67f637f83b2a549627_JaffaCakes118 | Triage

Sharing

General

Target

f004c217525cbf67f637f83b2a549627_JaffaCakes118
Size

294KB
MD5

f004c217525cbf67f637f83b2a549627
SHA1

631a3413514a1b7f1dd236463272e29de5496ada
SHA256

c1885e14687e62174565279175d405ea58a6f830add2321bb672b015c1a963fc
SHA512

87d056c00c19244d118c8fb577f631d5725e303829d715448011cc5e9ed81d5f1772a40830651121133050ecb4e0d326aca77c3a0d65630100a7574b37d5c390
SSDEEP

6144:pGNFQwRmv8FtzNdZ2kCytdLB68NhSyptLdQyXWR80IczRH6:pGNFQwU8Ftrn7rBLNhuyXWRVIczU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f004c217525cbf67f637f83b2a549627_JaffaCakes118

Files

f004c217525cbf67f637f83b2a549627_JaffaCakes118
.exe windows:5 windows x86 arch:x86

301fc7079d59edf38c18a0146ba65622

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Obnubilate\Temp\20tluo40psmgcvsgnvr08442u2\Stub.pdb

Imports

msvcrt

__set_app_type
_except_handler3
__p__fmode
_controlfp
__dllonexit
_onexit
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
fclose
fseek
ftell
strcmp
fread
memset
fopen
malloc
memmove
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy

psapi

GetModuleFileNameExA

kernel32

TerminateProcess

Sections

.TEXT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.DATA
Size: 512B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 286KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 374B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ